Scheduled Task Executing Registry Payload via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects the creation of a scheduled task that uses PowerShell to retrieve and execute a payload stored in the Windows Registry. This technique is often used for persistence and privilege escalation by malware like Qbot.